Below are the various steps involved in the creation of a data retention policy. 1.Understand and determine the applicable legal requirements of the…

The creation of a data retention policy follows a logical, structured lifecycle. The process must begin by assembling a cross-functional team (3) with representatives from legal, IT, and business units to ensure all perspectives are included. This team's first task is to understand the legal, regulatory, and business requirements for data retention (1), which forms the foundation of the policy. Subsequently, the team must identify and classify the organizational data (4) to which these requirements apply. Only after these foundational steps are complete can the team effectively develop the policy document (5). The final step in this sequence is implementation, which involves communicating the policy and training employees to ensure organization-wide understanding and compliance (2).

A. This sequence is incorrect because training employees (2) cannot logically occur before the policy is developed (5) or legal requirements are understood (1).
C. This option incorrectly places employee training (2) before the policy is actually developed (5), which is an illogical order of operations.
D. This sequence is flawed as it suggests developing the policy (5) before forming a team (3) or identifying the data to be governed (4).

1. NIST Special Publication 800-100, "Information Security Handbook: A Guide for Managers": Chapter 10, "Information Security Policy," outlines a top-down approach for policy development. It emphasizes that an organization must first establish the information security governance structure (analogous to building a team) and then identify all applicable laws and regulations before developing and disseminating specific policies. This supports the sequence of team formation, legal review, policy development, and then communication.

2. University of California, Berkeley, "Policy Lifecycle": The campus's official policy management framework details a lifecycle that begins with "Proposal & Drafting." This initial phase involves identifying stakeholders (building a team), researching requirements (legal and regulatory analysis), and identifying the scope (data identification). This is followed by the development of the policy and subsequent "Publication & Communication" to ensure the community understands it. This model aligns with the sequence 3 → 1 → 4 → 5 → 2. (Source: UC Berkeley, Office of Ethics, Risk, and Compliance Services).

3. Smallwood, R. F. (2014). Information governance: Concepts, strategies, and best practices. John Wiley & Sons. This text, often used in university curricula, describes the Information Governance Reference Model (IGRM). The model's principles dictate that legal and regulatory requirements must be understood before creating policies that classify and manage information assets. The implementation phase, which includes communication and training, follows policy development. This supports the foundational nature of steps 1, 3, and 4 before steps 5 and 2. (See Chapter 3: "Information Governance Principles and Reference Model").